NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8375-1 advisory.

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain memory operations     when doing SMTP authentication. This could possibly result in sensitive information being sent to the     authentication server. (CVE-2025-53859)

    It was discovered that nginx incorrectly handled proxying to upstream TLS servers. An attacker could     possibly use this issue to insert plain text data into the response from an upstream proxied server.
    (CVE-2026-1642)

    It was discovered that the nginx ngx_mail_auth_http_module module incorrectly handled certain requests. An     attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service.
    (CVE-2026-27651)

    It was discovered that the nginx ngx_http_dav_module module incorrectly handled certain destination URIs.
    An attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     modify source or destination names outside of the document root. (CVE-2026-27654)

    It was discovered that the nginx ngx_http_mp4_module module incorrectly handled certain MP4 files. An     attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2026-27784, CVE-2026-32647)

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain CRLF sequences.
    An attacker could possibly use this issue to inject arbitrary SMTP headers. (CVE-2026-28753)

    It was discovered that nginx contained a use-after-free vulnerability in the ngx_http_ssl_module module     when client certificate verification and OCSP validation were enabled. A remote attacker could use this     issue to cause nginx to crash, resulting in a denial of service, or possibly modify data in memory.
    (CVE-2026-40701)

    It was discovered that nginx did not properly handle certain proxied responses in the     ngx_http_charset_module module. A remote attacker could possibly use this issue to obtain sensitive     information or cause nginx to crash, resulting in a denial of service. (CVE-2026-42934)

    It was discovered that the nginx ngx_http_rewrite_module component incorrectly handled certain rewrite     directives. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2026-42945)

    It was discovered that nginx did not properly process certain SCGI and uWSGI responses. An attacker able     to perform a machine-in-the-middle attack could possibly use this issue to obtain sensitive information or     cause nginx to crash, resulting in a denial of service. (CVE-2026-42946)

    It was discovered that nginx incorrectly handled certain rewrite rules in the ngx_http_rewrite_module     module. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-9256)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8354-1 advisory.

    It was discovered that nginx did not properly validate source addresses in the HTTP/3 QUIC module. A     remote attacker could possibly use this issue to bypass authorization checks or rate limiting. This issue     only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-40460)

    It was discovered that nginx contained a use-after-free vulnerability in the ngx_http_ssl_module module     when client certificate verification and OCSP validation were enabled. A remote attacker could use this     issue to cause nginx to crash, resulting in a denial of service, or possibly modify data in memory.
    (CVE-2026-40701)

    It was discovered that nginx did not properly handle certain proxied responses in the     ngx_http_charset_module module. A remote attacker could possibly use this issue to obtain sensitive     information or cause nginx to crash, resulting in a denial of service. (CVE-2026-42934)

    It was discovered that nginx did not properly process certain SCGI and uWSGI responses. An attacker able     to perform a machine-in-the-middle attack could possibly use this issue to obtain sensitive information or     cause nginx to crash, resulting in a denial of service. (CVE-2026-42946)

    It was discovered that nginx incorrectly handled certain rewrite rules in the ngx_http_rewrite_module     module. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-9256)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20796-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is     enabled       (bsc#1260415).
    - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file     (bsc#1260420).
    - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the     `ssl_ocsp` directives       are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
    - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module`     module       (bsc#1265231).
    - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`       (bsc#1265232).
    - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module`     and       `ngx_http_uwsgi_module` modules (bsc#1265233).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21832-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is     enabled       (bsc#1260415).
    - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file     (bsc#1260420).
    - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the     `ssl_ocsp` directives       are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
    - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module`     module       (bsc#1265231).
    - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`       (bsc#1265232).
    - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module`     and       `ngx_http_uwsgi_module` modules (bsc#1265233).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nginx installed on the remote host is prior to 1.30.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-012 advisory.

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able     to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note:
    Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-40460)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the     ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the     leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can     send requests along with conditions beyond its control that may cause a heap-use-after-free error in the     NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker     process restarting.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-40701)

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also     uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream     peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42926)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset,     source_charset, and charset_map and proxy_pass with disabled buffering (off) directives are configured,     unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a     heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42934)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This     vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an     unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string     that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control     can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in     the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout     Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached     End of Technical Support (EoTS) are not evaluated. (CVE-2026-42945)

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in     excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an     unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream     server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions     which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-42946)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1714 advisory.

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able     to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note:
    Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-40460)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the     ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the     leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can     send requests along with conditions beyond its control that may cause a heap-use-after-free error in the     NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker     process restarting.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-40701)

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also     uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream     peer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42926)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset,     source_charset, and charset_map and proxy_pass with disabled buffering (off) directives are configured,     unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a     heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.



    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
    (CVE-2026-42934)

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This     vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an     unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string     that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control     can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in     the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout     Randomization (ASLR ) disabled, code execution is possible.  Note: Software versions which have reached     End of Technical Support (EoTS) are not evaluated. (CVE-2026-42945)

    A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in     excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an     unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream     server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions     which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-42946)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2050-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is     enabled       (bsc#1260415).
    - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file     (bsc#1260420).
    - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the     `ssl_ocsp` directives       are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
    - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module`     module       (bsc#1265231).
    - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`       (bsc#1265232).
    - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module`     and       `ngx_http_uwsgi_module` modules (bsc#1265233).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1ed77d8e-53bb-11f1-b339-3497f65b111b advisory.

    The nginx project reports:
    nginx 1.31.0 fixes multiple security issues affecting HTTP/2                 proxying, rewrite handling, SCGI/uWSGI response handling, charset                 conversion, HTTP/3 connection migration, and OCSP resolver response                 processing.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its Server response header, the installed version of nginx is prior to 1.30.1. It is, therefore, affected by the following issues :

 - A heap-use-after-free vulnerability in the ngx_http_ssl_module module when ssl_verify_client is set to 'on' or 'optional' and ssl_ocsp is enabled with a resolver, which may allow an unauthenticated remote attacker to cause worker process restarts or limited memory modification. (CVE-2026-40701)

 - A vulnerability in the ngx_quic_module module when HTTP/3 is enabled that allows an attacker to spoof their source IP address, potentially bypassing IP-based authorization or rate limiting. (CVE-2026-40460)

 - A heap buffer over-read vulnerability in the ngx_http_charset_module module when charset, source_charset, charset_map, and proxy_pass with response buffering disabled are all configured, which may allow an unauthenticated remote attacker to cause limited memory disclosure or a worker process restart. (CVE-2026-42934)

 - A vulnerability in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may allow an attacker with man-in-the-middle access to upstream SCGI or uWSGI responses to trigger excessive memory allocation or a data over-read, potentially disclosing worker memory or causing a restart. (CVE-2026-42946)

 - A heap buffer overflow vulnerability in the ngx_http_rewrite_module module when a rewrite directive is followed by rewrite, if, or set with unnamed PCRE captures and a replacement string containing '?', which may allow an unauthenticated remote attacker to cause worker process restarts or, on systems without ASLR, potentially execute code. (CVE-2026-42945)

 - A vulnerability in the ngx_http_proxy_v2_module module when proxy_http_version 2 and proxy_set_body are used together that allows an attacker to inject HTTP/2 frame headers and payload bytes toward the upstream peer. (CVE-2026-42926)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4589 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4589-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/          Carlos Henrique Lima Melara     May 18, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nginx     Version        : 1.18.0-6.1+deb11u6     CVE ID         : CVE-2025-53859 CVE-2026-1642 CVE-2026-27651 CVE-2026-27654                      CVE-2026-27784 CVE-2026-28753 CVE-2026-32647 CVE-2026-40701                      CVE-2026-42934 CVE-2026-42945 CVE-2026-42946     Debian Bug     : 1111138 1127053

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web and     reverse proxy server, which could result in bypass of authorisation rules or     rate limits, denial of service or memory disclosure.

    CVE-2025-53859

        NGINX Open Source has a vulnerability in the ngx_mail_smtp_module that         might allow an unauthenticated attacker to over-read NGINX SMTP         authentication process memory; as a result, the server side may leak         arbitrary bytes sent in a request to the authentication server. This issue         happens during the NGINX SMTP authentication process and requires the         attacker to make preparations against the target system to extract the         leaked data. The issue affects NGINX only if (1) it is built with the         ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method         none, and (3) the authentication server returns the Auth-Wait response         header.

    CVE-2026-1642

        A vulnerability exists in NGINX OSS when configured to proxy to upstream         Transport Layer Security (TLS) servers. An attacker with a         man-in-the-middle (MITM) position on the upstream server sidealong with         conditions beyond the attacker's controlmay be able to inject plain text         data into the response from an upstream proxied server.

    CVE-2026-27651

        When the ngx_mail_auth_http_module module is enabled on NGINX Open Source,         undisclosed requests can cause worker processes to terminate. This issue         may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the         authentication server permits retry by returning the Auth-Wait response         header.

    CVE-2026-27654

        NGINX Open Source has a vulnerability in the ngx_http_dav_module module         that might allow an attacker to trigger a buffer overflow to the NGINX         worker process; this vulnerability may result in termination of the NGINX         worker process or modification of source or destination file names outside         the document root. This issue affects NGINX Open Source when the         configuration file uses DAV module MOVE or COPY methods, prefix location         (nonregular expression location configuration), and alias directives. The         integrity impact is constrained because the NGINX worker process user has         low privileges and does not have access to the entire system.

    CVE-2026-27784

        The 32-bit implementation of NGINX Open Source has a vulnerability in the         ngx_http_mp4_module module, which might allow an attacker to over-read or         over-write NGINX worker memory resulting in its termination, using a         specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source         if it is built with the ngx_http_mp4_module module and the mp4 directive is         used in the configuration file. Additionally, the attack is possible only         if an attacker can trigger the processing of a specially crafted MP4 file         with the ngx_http_mp4_module module.

    CVE-2026-28753

        NGINX Open Source has a vulnerability in the ngx_mail_smtp_module module         due to the improper handling of CRLF sequences in DNS responses. This         allows an attacker-controlled DNS server to inject arbitrary headers into         SMTP upstream requests, leading to potential request manipulation.

    CVE-2026-32647

        NGINX Open Source has a vulnerability in the ngx_http_mp4_module module,         which might allow an attacker to trigger a buffer over-read or over-write         to the NGINX worker memory resulting in its termination or possibly code         execution, using a specially crafted MP4 file. This issue affects NGINX         Open Source if it is built with the ngx_http_mp4_module module and the mp4         directive is used in the configuration file. Additionally, the attack is         possible only if an attacker can trigger the processing of a specially         crafted MP4 file with the ngx_http_mp4_module module.

    CVE-2026-40701

        NGINX Open Source has a vulnerability in the ngx_http_ssl_module module         when the ssl_verify_client directive is set to on or optional, and the         ssl_ocsp directive is set to on or the leaf parameters are configured         with a resolver. With this configuration, an unauthenticated attacker can         send requests along with conditions beyond its control that may cause a         heap-use-after-free error in the NGINX worker process. This vulnerability         may result in limited modification of data or the NGINX worker process         restarting.

    CVE-2026-42934

        NGINX Open Source has a vulnerability in the ngx_http_charset_module         module. When charset, source_charset, and charset_map and proxy_pass with         disabled buffering (off) directives are configured, unauthenticated         attackers can send requests that with conditions beyond the attackers'         control to cause a heap buffer over-read in the NGINX worker process,         leading to limited disclosure of memory or a restart.

    CVE-2026-42945

        NGINX Open Source has a vulnerability in the ngx_http_rewrite_module         module. This vulnerability exists when the rewrite directive is followed by         a rewrite, if, or set directive and an unnamed Perl-Compatible Regular         Expression (PCRE) capture (for example, $1, $2) with a replacement string         that includes a question mark (?). An unauthenticated attacker along with         conditions beyond its control can exploit this vulnerability by sending         crafted HTTP requests. This may cause a heap buffer overflow in the NGINX         worker process leading to a restart. Additionally, for systems with Address         Space Layout Randomization (ASLR) disabled, code execution is possible.

    CVE-2026-42946

        A vulnerability exists in the ngx_http_scgi_module and         ngx_http_uwsgi_module modules that may result in excessive memory         allocation or an over-read of data. When scgi_pass or uwsgi_pass is         configured, an unauthenticated attacker with man-in-the-middle (MITM)         ability to control responses from an upstream server may be able to read         the memory of the NGINX worker process or restart it.

    For Debian 11 bullseye, these problems have been fixed in version     1.18.0-6.1+deb11u6.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6278 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6278-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 16, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : nginx     CVE ID         : CVE-2026-40701 CVE-2026-42934 CVE-2026-42945                      CVE-2026-42946 CVE-2026-40460

    Multiple vulnerabilities were discoverd in Nginx, a high-performance web     and reverse proxy server, which could result in bypass of authorisation     rules or rate limits, denial of service or memory disclosure.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1.22.1-9+deb12u7.

    For the stable distribution (trixie), these problems have been fixed in     version 1.26.3-3+deb13u5.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-38623b4fed advisory.

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-094eb13bb1 advisory.

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx-mod-js-challenge:

    - Rebuild for 1.30.1

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-fb53cb4d67 advisory.

    nginx-mod-brotli:

    - Rebuild for 1.30.1

    nginx-mod-vts:

    - Rebuild for 1.30.1

    nginx-mod-modsecurity:

    - Rebuild for 1.30.1

    nginx-mod-fancyindex:

    - Rebuild for 1.30.1

    nginx-mod-headers-more:

    - Rebuild for 1.30.1

    nginx-mod-naxsi:

    - Rebuild for 1.30.1

    nginx:

    - update to 1.30.1
    - fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934,       CVE-2026-40460 and CVE-2026-40701




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3414ac89-4f9f-11f1-a1c0-0050569f0b83 advisory.

    nginx development team reports:
    When using the proxy_set_body directive, an attacker               might inject data in the proxied request to an HTTP/2 backend     A heap memory buffer overflow might occur in a worker               process while handling a specially crafted request by               ngx_http_rewrite_module, potentially resulting in arbitrary code               execution     A heap memory buffer overread might occur in a worker               process while handling a specially crafted response by               ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker               to cause a disclosure of worker process memory or segmentation fault               in a worker process     A heap memory buffer overread might occur in a worker               process while handling a specially sent response with decoding from               UTF-8 via the charset_map directive, allowing an attacker to cause               a limited disclosure of worker proccess memory or segmentation fault               in a worker process     When using HTTP/3, processing of connection migration might               cause new QUIC streams to receive a new client address before               validation, allowing an attacker to cause address spoofing     use-after-free might occur during DNS server response               processing if the ssl_ocsp directive was used, allowing an attacker               to cause worker process memory corruption or segmentation fault in a               worker process

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the     ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the     leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can     send requests along with conditions beyond its control that may cause a heap-use-after-free error in the     NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker     process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not     evaluated. (CVE-2026-40701)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318631	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-8375-1)	Nessus	Ubuntu Local Security Checks	critical
318250	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : nginx vulnerabilities (USN-8354-1)	Nessus	Ubuntu Local Security Checks	critical
317697	openSUSE 16 Security Update : nginx (openSUSE-SU-2026:20796-1)	Nessus	SuSE Local Security Checks	critical
317667	SUSE SLES16 Security Update : nginx (SUSE-SU-2026:21832-1)	Nessus	SuSE Local Security Checks	critical
316959	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-012 (ALASNGINX1-2026-012)	Nessus	Amazon Linux Local Security Checks	critical
316933	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1714)	Nessus	Amazon Linux Local Security Checks	critical
316725	SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2050-1)	Nessus	SuSE Local Security Checks	critical
315600	FreeBSD : nginx-devel -- multiple vulnerabilities (1ed77d8e-53bb-11f1-b339-3497f65b111b)	Nessus	FreeBSD Local Security Checks	critical
115243	Nginx < 1.30.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
315178	Debian dla-4589 : libnginx-mod-http-auth-pam - security update	Nessus	Debian Local Security Checks	critical
315084	Debian dsa-6278 : libnginx-mod-http-geoip - security update	Nessus	Debian Local Security Checks	critical
314992	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-38623b4fed)	Nessus	Fedora Local Security Checks	critical
314989	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)	Nessus	Fedora Local Security Checks	critical
314984	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	Nessus	Fedora Local Security Checks	critical
314915	FreeBSD : www/nginx -- Remote Code Execution/DoS (3414ac89-4f9f-11f1-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	critical
314520	Linux Distros Unpatched Vulnerability : CVE-2026-40701	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40701

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium